Luke Chen created KAFKA-21178:
---------------------------------
Summary: Allow kafka admin to disable some compression methods
Key: KAFKA-21178
URL: https://issues.apache.org/jira/browse/KAFKA-21178
Project: Kafka
Issue Type: Improvement
Reporter: Luke Chen
We've seen the snappy-java CVEs
* CVE-2026-93452 ([snappy
issue|https://github.com/xerial/snappy-java/issues/732])
* CVE-2026-90559 ([snappy
issue|https://github.com/xerial/snappy-java/issues/728])
Unfortunately, the snappy-java community seems to be not maintained anymore.
Moreover, the is [lz4-jave community|https://github.com/lz4/lz4-java] is not
maintained anymore, either. Currently, we use the [forked
repo|https://github.com/yawkat/lz4-java] created by a user (yawkat). The single
user repository might enter the unmaintained state anytime.
proposal:
To improve that, we can create a config to allow kafka admin to disable some
compression methods when written. This way, we can avoid the bad users to
attack kafka using these impacted compression methods.
Note: we cannot get rid of these compression methods because the history log in
kafka will not be able to be decompressed anymore.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
